Analysis

  • max time kernel
    167s
  • max time network
    187s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    24-05-2024 02:04

General

  • Target

    6d04af25e1e9b7336d2e57afbd62b999_JaffaCakes118.apk

  • Size

    15.2MB

  • MD5

    6d04af25e1e9b7336d2e57afbd62b999

  • SHA1

    37750e7a23b0fe3c3e876c1898c456d6b525da3f

  • SHA256

    1e8067ef7f6fce35184e7898724222374567f0f468edcff1d25e7636e0fb2528

  • SHA512

    1091b69b459446691b74979eeebf3118685296097b214989a05d6edca7c390019a241c63cd9563aeb69f9f2f20986acbb8f4385f7a02ca9d12938ab84a510042

  • SSDEEP

    393216:AS4kiviQJ95v4e751utE02uck8x3q1Nm/g4E6C:9/Qb75eETuc3x61A/gx

Malware Config

Signatures

  • Requests cell location 2 TTPs 3 IoCs

    Uses Android APIs to to get current cell location.

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

Processes

  • com.dajie.business
    1⤵
    • Requests cell location
    • Checks CPU information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4563
  • com.dajie.business:remote
    1⤵
    • Requests cell location
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4665

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.dajie.business/databases/campus_offcial_app
    Filesize

    28KB

    MD5

    1f6aab9f6488555ac4f6393054c9c90e

    SHA1

    d587b4aa047f0e8d0840f1f9bc5a428dee79f552

    SHA256

    2342d5262efcec7740840de4dd008734b23088add01635aed2579f5770761379

    SHA512

    c587f15c97783e41c950151caef082b94945b2cc517ccf57e7596a7713dbb9fab70bc6571625da521621437c08f3842ad660425c693d2191578d92e4545b7c51

  • /data/user/0/com.dajie.business/databases/campus_offcial_app-journal
    Filesize

    512B

    MD5

    da2b156d1aed297c1a7bc632dcf5942a

    SHA1

    06246de6412c0ac2f3ad84b930f61148093c54cb

    SHA256

    9fbf7b0d23a6b253fcabe5e57ce43458c38e5eb158f12c85af7afe6ab976bb1b

    SHA512

    0cd878b74765b3c838b022af39000ac45c4cee2f5efdd751742260c771fb0230e888b978c65d9e361c487eeb13affc3375cb7020c8a143d29faf5e428238900b

  • /data/user/0/com.dajie.business/databases/campus_offcial_app-journal
    Filesize

    28KB

    MD5

    e2c58b77c8409b969743565ec4a39d38

    SHA1

    cf67fd7fe48b4c0d371c7038953d96ae66cee0a4

    SHA256

    56574ed9d8db3a39aa60baaafa9f8b1c55353a494718918eceebb096ef1f773c

    SHA512

    768db6a41301f9b0d6e36911e2635bd5d4f69e7b5ca755787b7d53669e2ce740669b8a5d2d0c5e49c765195af9098f6c61a87c12be7cfe435d4f19e26597813b

  • /data/user/0/com.dajie.business/databases/campus_offcial_app-journal
    Filesize

    8KB

    MD5

    fc23cea815bdda5dd17e8ea2c76a2138

    SHA1

    635b632834630f2cb16df12e60925eb3e2e8e900

    SHA256

    5eea56a740fa46399f26bb567805b5f39f5f4fa86f7d6777ebcee0822fcbaeb2

    SHA512

    35e56a57d8c7cc51d8012043685da7154dfc8c2cf7360229f210e0fd2421494642777dc0d45d92c5489d7751477654fefe6283c09b9d8f6a4d29b939d81b089a

  • /data/user/0/com.dajie.business/databases/dajie_business
    Filesize

    112KB

    MD5

    a135f0ddc651414dcbd41984649f0084

    SHA1

    9db67cc06f7104ff20182cb51e969f33977b130f

    SHA256

    454b805b540f8672876e991f0be6170f464fa1e14afa248e70fa5b28b2e5bd87

    SHA512

    c7c68f932e6ac622240f7d349923048d54bed3d1ba753e891a046db209d9db065d010ffef5bccf07d27328373e0a46543b097acc01d638490d33febb6e9fd7da

  • /data/user/0/com.dajie.business/databases/dajie_business-journal
    Filesize

    8KB

    MD5

    611f883e406b238b9277b30f118aba74

    SHA1

    5a314425d531ac96059aa8df66dcb1250aa1206c

    SHA256

    59fabb595f1d9846217f01d5b13e2f9260c582b4faec08386ecbad64d19dc709

    SHA512

    9285538b6a1ed51dc0a65662e7851d61292034de0844fc4dca6d576af37c613020aee73105aafd517c57a70fafd24ca40ec54475d9ec32a9d4d386801ff5b5fb

  • /data/user/0/com.dajie.business/databases/dajie_business-journal
    Filesize

    8KB

    MD5

    3d4827cee156f859ab621681efeb9811

    SHA1

    6a1d104e19b284288f98f5f8c4cfb3f28551130e

    SHA256

    f67fbc368169994a8802b51a779d5932c71430aa662642c18e291e9ec576c524

    SHA512

    e7db5bd489d6856bd2e94d713d1507049755b7f3f074aed3130ea4a5fe128463723c97e0eb7598c47ae7597d0308c37432991e66d259ff0802486e68656adf52

  • /data/user/0/com.dajie.business/databases/dajie_business-journal
    Filesize

    8KB

    MD5

    440a8a638e0eb7a0941299b37d1de1dd

    SHA1

    37d26ccc0da602bc566f7359cf85bafc3e0251ad

    SHA256

    dcc2e75bd1059e1040af5c280dc497bb5cc698be2b0f34da0bb8feff5e25ae89

    SHA512

    ab6251d5a9468a03eff1921aa490af2833db5979b2946d0f79b1a47b1d4d441db4554b7faaf0a0166e65061772e8d2ee156d9ddd4c3a2e54cdcd4bcf1fc8bb9c

  • /data/user/0/com.dajie.business/files/libcuid.so
    Filesize

    109B

    MD5

    aab8aee7ed22f4718990774107dfb573

    SHA1

    71c23ea1ecd5c2af012d7d5ce1854384567c2a21

    SHA256

    37ddd4f73908623f6b606b328f93ad08c0396a18e60032c46bbb82c6c6d84f47

    SHA512

    c57b5bcd4b1a887ea67365856301bd0f079db0fce354acb0b5f3edbd469005e311dc678e11640fb2cf6805a6600b9c28e768fd6cef11206f3eb91717513fbc2c

  • /data/user/0/com.dajie.business/files/lldt/firll.dat
    Filesize

    76B

    MD5

    e68900302c8604be0981a2b365294a7c

    SHA1

    c874b918b80e0b01dc4433dbb66a1c7dc78ce5b7

    SHA256

    4feafda887b90cab4ddce9c60f1bb415acb7153bbd15984a52d97b3f2011cd5b

    SHA512

    2b37430b9be77c2ad39aa9ce6e6b2722f0d5d9a52dbb9cadd2c3a4aaf7ef80ebe23b574f15116a14fcf0cd432a86cbfbf136d063c033468c0c46d72f865152b7

  • /data/user/0/com.dajie.business/files/mobclick_agent_cached_com.dajie.business
    Filesize

    120B

    MD5

    ab1f613eec71e7950909f5f1c66b1a36

    SHA1

    fc8c3735a37b5f06caf7bc47a627a0045bb1fa58

    SHA256

    f04a0aee53c897918fd2f006815854a1ba1106b9145d55059e8a24418750a846

    SHA512

    aa13a2bfbde1236051b0eed74a626bd2e4e7c64d530c5939f7cc0d479556fdb7657ccd135058654bf09b940ee705ccf79113cd68c06d8e5fe617247636c3bf26

  • /data/user/0/com.dajie.business/files/mobclick_agent_cached_com.dajie.business
    Filesize

    208B

    MD5

    b8491a1423bfec72b4c261c8aa3be730

    SHA1

    77d9e6e6d5e29403eafefa79bb2cf328c2b5252b

    SHA256

    75c22bea53ab4af88fb98fba9889f95e84ea86e81d896fbdb91fc12f3fe89fdd

    SHA512

    da2bc691177b3c0d651ac24bfc7649fad474d76d538a1bb5297c6c32151e591501b7f336dad62a67fdf1075ed4a8fb407a925107ece5b4390f78bed818d12df8

  • /data/user/0/com.dajie.business/files/ofld/ofl.config
    Filesize

    235B

    MD5

    91f429ca44fd3eb422ca88e9bcd5fa3a

    SHA1

    212a27fedfde7263d9bf1f300eaae062b0f3bcb1

    SHA256

    98486198d6bad8e9e710584eced87ef80634549341a0258ae8d057dbe1d6e24a

    SHA512

    4518840769617c47a0000e1ea1f5a8b610718ef957fbb8af71b6af4962cc0eda21abbcffe96769a09387061ddf7a94622cca11cc0a5a64b55a6114dc6a60ac64

  • /data/user/0/com.dajie.business/files/ofld/ofl_location.db
    Filesize

    28KB

    MD5

    70250d085aabacd99c041ce264938e43

    SHA1

    dad342fb53882dcc32e1ce04be265a342daf4907

    SHA256

    89fd8bcda94093e5008bb7c7dbdcc4fe0345daef72c1ff4b7d28d36cb085bc57

    SHA512

    d2220e709d1a5a5ae3412321d2d300acf14d2a63be0ff8d64b39fc19172498938685ab830aaea1373ece3b6ce5178d19e3ba81349ecf642f3e58a54703f6f496

  • /data/user/0/com.dajie.business/files/ofld/ofl_location.db-journal
    Filesize

    512B

    MD5

    6cfde4a69c927e9707133735f0979f81

    SHA1

    ea6cf913b874b4041d5a8b4b040622972e52c4ac

    SHA256

    94e7e7e18df2ebeb8a4e40db6ae0244cbe1a1ab3cf0792668a5ec69154a351fa

    SHA512

    f80e1ccebd2d7e3ab7d939cde3a7288238179076f2a7a6c2a8e391f48210acdd6378d8865d49d327ec46e3b9d6d6d56f1b166a3133c32cd27ec28e0a0f926e7c

  • /data/user/0/com.dajie.business/files/ofld/ofl_location.db-journal
    Filesize

    8KB

    MD5

    d2fa902a20e95a68710d651afc3fc48f

    SHA1

    ae6626cc8daddc47db929a2dd210702798d0a8bb

    SHA256

    aeee24d72bc9ede916440078dabd505c0fe08e3d5ee57eae724f3b84bb4e415e

    SHA512

    08420d99f45a4f6c924eeed94e9805c0b9fda739ff6fe7a805df0e60ca99f046a96f460fd25bd379d84c79376269ea0395849835aa5d78ba5b6a1bade83b4382

  • /data/user/0/com.dajie.business/files/ofld/ofl_location.db-journal
    Filesize

    8KB

    MD5

    a30adac0fc17974e6598b4132d166077

    SHA1

    508944d638ddd55fe1c300583fbe550f085be0d5

    SHA256

    324e06e55060b76ae4323eab6834b75051506b262945b9022b40a4cde69fa071

    SHA512

    b77fa8f5a94e15f5922d54ba866b2596ab7960cffc67e68fa4d75451d0af8dedc087122bddaf9392bab0516cb43adb52b3cbcd9b9750fd4317358b19f076d017

  • /data/user/0/com.dajie.business/files/ofld/ofl_location.db-journal
    Filesize

    8KB

    MD5

    1a6a05fc79a1b93109acd76f1d83a0ef

    SHA1

    78f4542a77b73e3abf81def0f63fd457e52dfe04

    SHA256

    91acbb1b35ac8c92555fc4e83f11680bace345ec369fbb18e13cc505c8ccddf6

    SHA512

    3385c17c7a588df7db958157877d16950fa2d9402170b09abfe5834517e4144b826bff07d6bb06f69019bf074ff226e557f4adc7360e8bc7e6c7b454ace46644

  • /data/user/0/com.dajie.business/files/ofld/ofl_statistics.db
    Filesize

    80KB

    MD5

    faeea37abd335887cba10e6065b19973

    SHA1

    6f766fd898f257b5bd965900726606372fdc5d98

    SHA256

    d7d98faf14c873d571ff254741bc81968ffe3329fba66a6e26d8386153720fb3

    SHA512

    912c54574acb103dd2d25388213b04c212f8001282d52580f68243e222c1e79d7237a96bc717bb6f1cfcb9a455ef1464799e11b79e1b17de5a248a1015b54e3e

  • /data/user/0/com.dajie.business/files/ofld/ofl_statistics.db-journal
    Filesize

    512B

    MD5

    f20b258ae514bc25e9796e75df10e889

    SHA1

    ceadcb7f6c30bb53170a97c9301bfafcad762106

    SHA256

    2ce6a18178533d4e5de6f708e916fce0b704a6e22944fe8cd3f740ada324f77a

    SHA512

    d5b35555fa824e206d948d420c075c0f6ae1afd5e1dacb27c433d0e6bd771743c81dfba144362c41ffc697242192764e54104ce355a583d1f69310eb7db5acbd

  • /data/user/0/com.dajie.business/files/ofld/ofl_statistics.db-journal
    Filesize

    8KB

    MD5

    1ff403f4bad49d7086baf3d41c7ecd65

    SHA1

    3fc6ba1fd78b403cc9ae972e88407b9c76c40ef1

    SHA256

    0c2eb42e4d9ebb2d09d9a44cb9e83a44c4210c3e0d206a13e68f3fef49bd402a

    SHA512

    c73f465ce2a544524d4292c7efe211684895737f367aa8a2e684ce47581e9a271ea790598eb266a58fef66324c4a0d81c7c174a715c89c08a79dd9c90e882ffe

  • /data/user/0/com.dajie.business/files/ofld/ofl_statistics.db-journal
    Filesize

    8KB

    MD5

    b80fd48c2a8e1b09fb4873d2421c2540

    SHA1

    f1fabb3fdd2e01658551dea490c684e62346e34b

    SHA256

    0fefc21bb016489abe944b4cd0db32a139be14f6b7f2299891851b44f301be15

    SHA512

    bfe2eb4f8095afbf7a1aa8cdaaed5fafbd796cb2cf6bdc9d37aa0ff82a55732ef59731e04203858101da510d432f57096f1415f92a64844274832ef7cd81c400

  • /data/user/0/com.dajie.business/files/ofld/ofl_statistics.db-journal
    Filesize

    8KB

    MD5

    d93724bafdff425b64bc5307565fc6ff

    SHA1

    7cb91f18cb50706a0ad4a9c4ebfff67805f017fb

    SHA256

    27cd832c6da9028b93f6c5a891d95878a567a47ff405ed9fd0f4b941655e11fe

    SHA512

    b37108f42c43410fd72bfa43f9a88d77a6c8ddf8030907b5fd498f8441f48ab78c252632b72de1da816a4a3558266bcf1eaa6553f3121b2b54152fdaeafde79e

  • /data/user/0/com.dajie.business/files/ofld/ofl_statistics.db-journal
    Filesize

    8KB

    MD5

    57ffcc62304228f93fa24330f903c960

    SHA1

    f62ff708c19ed9fbd6a7d78add71e57b650ffaf0

    SHA256

    5e87a7932a6531822246abd9da0d059d3e58ba45f99c7918ee8f6d5396f3c0fa

    SHA512

    2edc2d0a1001cb3636abc4e1fafbfc1712469961966da1da6eb35ddb72e0be125807def8e3e4b3cf06be6ccc239bb7f5591ea4a74380132472121bea778a7691

  • /data/user/0/com.dajie.business/files/ofld/ofl_statistics.db-journal
    Filesize

    8KB

    MD5

    a956d0af9a737c47d6a1a1affeb0dd51

    SHA1

    4fad20a6a376cd9320916eb48d5d62531c934cce

    SHA256

    7fa1e99c7f4aeb2c616c6cd864e59fd50e7194d72d1596cfadbb8fac466b91cb

    SHA512

    e49afc0bfc0f9aeafd2bb948fe9d0b949da184d261481808f6291533e78d8d6c8692cdc2e5ccbefac98332869ffffc26ad547f59f1f52ce0b9efcaf4ee346bc4

  • /storage/emulated/0/Android/data/com.dajie.business/files/baidu/tempdata/conlts.dat
    Filesize

    12B

    MD5

    8d80bc8ea90e9cac010d3ddf97bda5f5

    SHA1

    f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07

    SHA256

    f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93

    SHA512

    9ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7

  • /storage/emulated/0/Android/data/com.dajie.business/files/baidu/tempdata/conlts.dat
    Filesize

    155B

    MD5

    4a6119f3858692f4891d0dd1789c4c26

    SHA1

    c040e1fb8f2f6916f941181f83113c2bd27ae6d0

    SHA256

    ba68ae29d5cf9f8ac50db246a4c7d62a5ee83963c4423a5949024862f544ca25

    SHA512

    8e63a42adb8c10b58c8a540d7bd12dd26a958eb8e49b387f199499a12080a65d906b1cc0194dee44d530c156d98e6cd171b9f447304738a4e4babe2dfe00062c

  • /storage/emulated/0/Android/data/com.dajie.business/files/baidu/tempdata/llg.dat
    Filesize

    24B

    MD5

    161557b06b4a4d3ce095528dea370eb7

    SHA1

    8bfe9c4d916fe58d856b5a6ecaf8cd9ea4df2c9f

    SHA256

    f054ef19481234ee5b2db1d1c681839dab235a857ed3a4bc02efa8f785f478d4

    SHA512

    96ce8aedbdbb387438efc86aaabd13a6378628bfae203d2bc25ea1cd7daa6ddbd6dd2c81d631fbdc9b653a93011d3c80f0c085580275b683d5e0bce077e6e449

  • /storage/emulated/0/Android/data/com.dajie.business/files/baidu/tempdata/llg.dat
    Filesize

    478B

    MD5

    5c4fedf56c27ada005d05819bb05e6cf

    SHA1

    d8fb7588add7770997d34ce24b672c435ae0d4df

    SHA256

    49939247a355d35c25c7c0c923d380dc9d41a65672013f7a4b7c56401eeb7c47

    SHA512

    29b9a689e5e1c8df2853115169c9d46578f98fe43106aeee970b75c7710a60d2e7db347335d4447581eb9b5f1d3ef2b56a15bf09e718165c56265bb8ae54ef5a

  • /storage/emulated/0/Android/data/com.dajie.business/files/baidu/tempdata/yoh.dat
    Filesize

    24B

    MD5

    a936690571e9104e1922dda4a0ba5bd1

    SHA1

    65f49c57edde2f96be2a1dbdfc3f7351f1e66554

    SHA256

    f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412

    SHA512

    3be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394

  • /storage/emulated/0/Android/data/com.dajie.business/files/baidu/tempdata/yoh.dat
    Filesize

    24B

    MD5

    1681ffc6e046c7af98c9e6c232a3fe0a

    SHA1

    d3399b7262fb56cb9ed053d68db9291c410839c4

    SHA256

    9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0

    SHA512

    11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

  • /storage/emulated/0/baidu/tempdata/lcvif.dat
    Filesize

    96B

    MD5

    ca5bc09b3632705466c52cc745b9ed9e

    SHA1

    b044c2efe8f427d3c088a0530ac2777d43c49d03

    SHA256

    e0c1c7c39be35cf17f8e2483a79af36e66ae7cb59cccbd0cc37315e86bfea2f9

    SHA512

    021335c216cd1af5367ed95f3fcfb03b969237245aa2a6a3dfec77fb114cf04078e089545a60c1d326ac29dce5f0828cddd915f89e8f1e71b5b4828bf30ce88f

  • /storage/emulated/0/dajie/crashlog/crash-1716516356955.txt
    Filesize

    3KB

    MD5

    4aba9f64280727fbea137fa564c320c8

    SHA1

    72e3d005bb34f94f0f1dc59a68af4bb48c92dd10

    SHA256

    c78735f55e8c76a79f31485473d27d293ffc965d66841608b64b94cba4a946e8

    SHA512

    2f8f514fd0a484d9dc80acc81ae62923386c9fa558d2e2d606d2a0097479f8e6eb5a01a5ea42a85817faf9e60d3f25a7baaddf8d7cd209794bccfb124441e893

  • /storage/emulated/0/dajie/crashlog/crash-1716516428234.txt
    Filesize

    3KB

    MD5

    a63985f2d866208d6c62074083c686f7

    SHA1

    6f7b8604385ad83bc37b2f09bf7fd23a08befa4a

    SHA256

    3a5aa2441a31adc2a98f5bc311911c9385f658711871d0d903bb8fd8c4cce8d9

    SHA512

    ab101524eea1da78df81be5692afbdd74e3b136c2eeeaf2916862bd72c15ad688ba08d17b58c50450621b334dcaf874ba45444cacf0fcf6cd1e8e7513aea97d5